{"vuid":"VU#882286","idnumber":"882286","name":"Samsung Web Viewer for Samsung DVR allows authentication bypass and password disclosure","keywords":["Samsung","web viewer","dvr","cwe-313","cwe-302","cookies","plaintext","password"],"overview":"Samsung Web Viewer for Samsung DVR contains multiple vulnerabilities including: Cleartext Storage in a File or on Disk (CWE-313) and Authentication Bypass by Assumed-Immutable Data (CWE-302).","clean_desc":"CWE-313: Cleartext Storage in a File or on Disk - CVE-2013-3585\nWeb Viewer for Samsung DVR stores user credentials in plaintext allowing an attacker to parse saved credentials on the user setup webpage. CWE-302: Authentication Bypass by Assumed-Immutable Data - CVE-2013-3586\nWeb Viewer for Samsung DVR contains a vulnerability in its cookie-handling procedure that accepts any input as a valid session ID if placed after SessionID=. This allows an attacker to send a specially crafted cookie containing an malicious SessionID to the web server which bypasses authentication and can provide access to internal pages, including camera controls and account settings. For example: headers = { \"Cookie\": \"=\", \"Accept\": \"text/plain\"} The CVSS score below reflects the authentication bypass attack.","impact":"A remote unauthenticated attacker may be able to retrieve the device's administrator password, allowing them to directly access the device's configuration web page or system password configuration files.","resolution":"Apply an Update Samsung has released updated firmware. Please see their statement on the Vendor Information page. If applying an update is not possible, please consider the following workaround.","workarounds":"Restrict access to the Samsung Web Viewer for Samsung DVR interface Restrict access to the Samsung DVR Web Viewer interface to trusted networks. If  possible, configure management and transit networks for separate VLANs,  or restrict access to the device using IP access lists.","sysaffected":"","thanks":"Thanks to \nAndrey Bezborodov\n for reporting this vulnerability.","author":"This document was written by Adam Rauf.","public":["https://www.samsung-security.com/products/video-recording-and-management/dvr.aspx","http://cwe.mitre.org/data/definitions/313.html","http://cwe.mitre.org/data/definitions/302.html"],"cveids":["CVE-2013-3585","CVE-2013-3586"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2013-05-30T17:37:41Z","publicdate":"2013-08-21T00:00:00Z","datefirstpublished":"2013-08-21T21:11:13Z","dateupdated":"2013-10-03T19:14:06Z","revision":35,"vrda_d1_directreport":"1","vrda_d1_population":"2","vrda_d1_impact":"4","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"H","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"C","cvss_availabilityimpact":"C","cvss_exploitablity":null,"cvss_remediationlevel":"OF","cvss_reportconfidence":"UC","cvss_collateraldamagepotential":"N","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"7.6","cvss_basevector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","cvss_temporalscore":"5.4","cvss_environmentalscore":"4.1","cvss_environmentalvector":"CDP:N/TD:M/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}